Advertisement






iUsability Pwned - aka. - Apple iphone automatically connects karmetasploit

CVE Category Price Severity
CVE-XXXX-XXXX CWE-XXX Unknown High
Author Risk Exploitation Type Date
Unknown High Remote 2009-07-11
CPE
cpe:cpe:/h:apple:iphone_os
CVSS EPSS EPSSP
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/S:C/C:N/I:L/A:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2009070015

Below is a copy:

Hi there, just in case you didn't see the post at my blog
http://remote-exploit.blogspot.com/ here is a small summit of the
problem:

The iPhone running OS 3 has a stupid usability feature. It seems like
the iPhone is automatically opening a browser when joining a network.

When joining a network, the iPhone tries to do the following:

1. DNS queries for www.apple.com
2. Opening http://www.apple.com/library/test/success.html

When both are successful, then fine... the phone gets back "success" and everything is ok.
When both are failing... that's fine as well because then the phone assumes that the Internet connection is not up and running.

If the phone can successfully query the name but get back any different content than "Success"
it assumes that there is a captive portal which requires you to authenticate first to get access to the Internet. (Hotels, Hotspots etc)

It seems like Apple was thinking.. damn that's annoying for the user... lets open up Safari automatically if this special case comes into place :-)

Usability kills security .... together with karmetasploit its a very evil thing. Get IPhone cookies, accounts and maybe even system control... depending on the bugs you have left to test.

You can see the whole thing as a video vimeo
http://www.vimeo.com/5466236 .... now lets find some new safari bugs
:-)

Greetings

Max



Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.